ISO/IEC 27701 — Privacy Information Management System (PIMS)

Why does it matter?

Almost every organization processes PII, the quantity and types are growing, and more situations require cooperation with other organizations on the processing (Introduction 0.1). ISO/IEC 27701 turns privacy from a set of promises into a management system whose results can be evidenced to business partners and verified independently, with the roles of controller and processor made explicit.

Key benefits include:

• Evidence of how PII is handled

By meeting the requirements an organization can generate evidence of how it processes PII, which can support agreements with business partners (Introduction 0.1).

• Independent verification

The use of the document can provide independent verification of that evidence, and interested parties can call for independently audited conformity (Introduction 0.1; Clause 4.2, Note 6).

• Roles that are stated

The organization determines whether it acts as a PII controller, including a joint PII controller, or as a PII processor, and keeps separate controls where it is both (Clause 4.1).

• One system with other standards

It applies ISO's harmonized management system framework, so a PIMS can be aligned or integrated with other standards, in particular the ISMS in ISO/IEC 27001 (Introduction 0.2).

• Built-in mappings

The document includes mappings to ISO/IEC 29100, ISO/IEC 27018, ISO/IEC 29151 and the EU General Data Protection Regulation, which can be read against local legal requirements (Introduction 0.1; Annexes C to E).

How does it work?

The requirements are in Clauses 4 to 10: context of the organization (4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). Clause 3 defines PIMS, joint PII controller and statement of applicability, and takes its other privacy terms from ISO/IEC 29100, the only normative reference (Clauses 2 and 3). Clause 11 gives further information on the annexes.

Privacy-specific work is in the controls. Annex A (normative) lists the PIMS reference control objectives and controls for PII controllers and PII processors, and Annex B (normative) gives the implementation guidance for both roles. Clause 4.1 requires the organization to determine its role, and each role is the subject of a separate set of controls. Privacy risk assessment and treatment (6.1.2, 6.1.3) are repeated in operation (8.2, 8.3), and a statement of applicability records necessary controls and the justification for including or excluding them (Clause 3.25).

Certification is by an accredited body. ISO/IEC 27706:2025, published the same day as the standard, sets requirements for bodies providing audit and certification of PIMS and replaces ISO/IEC TS 27006-2:2021. Annex F (informative) gives the correspondence between the 2025 and 2019 editions, which organizations use to carry over earlier work.

Key Elements

• Role determination (Clause 4.1)

Whether the organization acts as a PII controller, joint PII controller or PII processor, decided for each instance of processing because the role depends on who determines the purposes and means.

• Interested parties (Clause 4.2)

Those with interests or responsibilities in PII processing, including PII principals, customers, supervisory authorities, other PII controllers, processors and their sub-contractors.

• Scope and system (Clauses 4.3, 4.4)

The boundaries and applicability of the PIMS, and the system itself.

• Privacy policy and roles (Clauses 5.2, 5.3)

A privacy policy expressed by top management, and assigned responsibilities and authorities.

• Privacy risk assessment and treatment (Clauses 6.1.2, 6.1.3, 8.2, 8.3)

The planned and operational risk work, with privacy objectives set under Clause 6.2 and changes planned under 6.3.

• Controls and guidance (Annexes A and B)

Normative control objectives and controls for PII controllers and PII processors, with normative implementation guidance for both roles.

• Mappings (Annexes C to E)

Informative mappings to ISO/IEC 29100, the General Data Protection Regulation, and ISO/IEC 27018 and 29151.

• Audit and improvement (Clauses 9, 10)

Monitoring and measurement (9.1), an internal audit program (9.2), management review (9.3), continual improvement (10.1) and corrective action (10.2).

What does it cover?

ISO/IEC 27701:2025 is intended for PII controllers and PII processors holding responsibility and accountability for PII processing, and applies to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations (Clause 1). The organization sets the boundaries and applicability of its own PIMS (Clause 4.3). It can be used by joint PII controllers and by processors that use subcontracted processors or that act as subcontractors to other processors (Introduction 0.1).

What are its objectives?

The standard and its Introduction point to these purposes:

To specify requirements for establishing, implementing, maintaining and continually improving a PIMS, with guidance to assist implementation (Clause 1).

To let an organization generate evidence of how it handles the processing of PII, to support business agreements and other interested parties (Introduction 0.1).

To enable alignment or integration of the PIMS with other management system standards, in particular ISO/IEC 27001 (Introduction 0.2).

To set privacy objectives, consistent with the privacy policy, that achieve specific results (Clauses 3.6 and 6.2).

Framework in Context

ISO/IEC 29100 is the normative reference for privacy terms and principles, and Annex C maps the standard to it. The 2025 edition is redrafted as a stand-alone standard, although its Introduction names ISO/IEC 27001 as the management system standard it can be integrated with. ISO/IEC 27706:2025 governs the certification bodies. Accreditation bodies set transition rules: the Singapore Accreditation Council, for example, gave accredited certification bodies until October 31, 2027 to transition and requires them to move all clients to the 2025 edition by October 31, 2028, so confirm your own deadline with your certification body.

Common Framework Mappings

ISO/IEC 27701 is commonly mapped to the privacy laws and the security and cloud standards that its controls overlap with, so evidence gathered once can serve several programs.

Mapped frameworks include:

GDPR

ISO 27001:2022

ISO 27002:2022

ISO 27017

ISO 27018

ISO 29100

NIST Privacy Framework v1.0

SOC 2